What identity-theft protection, tax deductions, and reimbursement did South Carolina create after the 2012 Department of Revenue data breach (per SC IL #13-17)?

Plain-English summary

After the South Carolina Department of Revenue's 2012 security breach, the legislature enacted a package of laws to protect people affected by identity theft and state-agency data breaches — including an income tax deduction for buying identity theft protection. This Information Letter summarizes those provisions.

The new laws do five things:

1. Extend free State-provided protection. The State provided an additional year of identity theft protection and resolution services, free of charge, for eligible individuals, adult and minor dependents, and businesses whose financial or personal identifying information was compromised in the Department's 2012 breach. These services became available October 24, 2013, with an enrollment deadline of October 1, 2014, and credit-protection services ending October 31, 2014 unless the State extended the contract.

2. Allow an income tax deduction. Some individuals may deduct, from South Carolina taxable income, the actual cost of a contract or subscription for identity theft protection and resolution services for the taxable year — up to $300 for an individual taxpayer or $1,000 for joint returns or returns claiming dependents. The deduction is not allowed if the taxpayer (a) deducted the same cost as a business expense, or (b) is enrolled in the free State-provided services.

3. Create a reimbursement fund. The Department of Revenue Identity Theft Reimbursement Fund was established to potentially reimburse persons whose identifying information was obtained from a compromised state-agency computer system.

4. Strengthen identity-theft crime laws to make it easier for victims to initiate investigations and prosecute offenders.

5. Revise data-breach notification procedures for when a state agency experiences a data breach.

What this means for you

If you were affected by the 2012 Department of Revenue breach

You could enroll in an additional year of free identity theft protection and resolution services within the stated windows, and you may have qualified to seek reimbursement from the new fund.

If you paid for identity theft protection yourself

You may be able to deduct the actual cost on your South Carolina income tax return — up to $300 (individual) or $1,000 (joint or claiming dependents) — as long as you did not also deduct it as a business expense and are not enrolled in the free State services.

Common questions

Q: What income tax deduction does this create?
A: A deduction for the actual cost of identity theft protection and resolution services, up to $300 for an individual or $1,000 for joint returns or returns claiming dependents.

Q: Who cannot claim the deduction?
A: A taxpayer who deducted the same cost as a business expense, or who is enrolled in the free State-provided identity theft protection and resolution services.

Q: What was the free State coverage tied to?
A: The Department of Revenue's 2012 security breach; the extra year of free services became available October 24, 2013, with an October 1, 2014 enrollment deadline.

Source

• Landing page: https://dor.sc.gov/advisory-opinion-search
• Original PDF: https://dor.sc.gov/sites/dor/files/policies/IL13-17.pdf

Original ruling text

State of South Carolina

Department of Revenue
300A Outlet Pointe Blvd., Columbia, South Carolina 29210
P.O. Box 125, Columbia, South Carolina 29214

SC INFORMATION LETTER #13-17

SUBJECT:

Identity Theft Coverage, Protection and Procedures – New Laws
(Administrative)

DATE:

October 9, 2013

REFERENCE:

House Bill 3710, Part IB, Section 97, Proviso 97.12 (Act No. 101)
House Bill 3710, Part IB, Section 117, Proviso 117.136 (Act No. 101)
House Bill 3710, Part IB, Section 118, Proviso 118.18 (Act No. 101)
House Bill 3711, Section 2 (Act No. 104)
House Bill 3248, Sections 1 & 2 (Act No. 15)

AUTHORITY:

S. C. Code Ann. Section 12-4-320 (2000); Supp. 2012
S.C. Code Ann. Section 1-23-10(4) (2005)
SC Revenue Procedure #09-3

SCOPE:

An Information Letter is a written statement issued to the public to
announce general information useful in complying with the laws
administered by the Department. An Information Letter has no precedential
value.

The South Carolina legislature has enacted provisions designed to provide or expand relief to
persons potentially affected by identity theft or by breaches of data security at South Carolina
agencies. The new provisions:
•
•
•
•
•

Extend the time for identity theft protection and resolution services offered free of charge
by the State;
Allow some individuals an income tax deduction for their purchase of identity theft
protection and resolution services;
Provide potential reimbursement for persons whose identifying information has been
obtained from a compromised computer system maintained by a state agency;
Update laws that concern identity theft and related crimes, to make it easier for victims to
initiate investigations and prosecute offenders; and
Revise notification procedures in the event of a state agency data breach.
1

Taxpayer Protection Services – Extension of Coverage Free of Charge
The State is providing an additional year of identity theft protection and identity theft resolution
services free of charge for eligible individuals, adult and minor dependents, or businesses whose
financial information or personal identifying information was compromised as a result of the
Department of Revenue’s security breach of 2012.
These services will be available on October 24, 2013. The deadline to enroll is October 1, 2014.
Credit protection services will end on October 31, 2014, unless the state chooses to extend the
credit protection services contract. Additional information will be posted on the Department’s
website at: www.sctax.org.
Some Taxpayers May Claim an Income Tax Deduction for the Purchase of Identity Theft
Protection and Resolution Services
A deduction from South Carolina taxable income is allowed for certain costs incurred to
purchase identity theft protection or resolution services by contract or subscription. The
deduction is allowed for:
•
•

Individuals who filed a return (paper or electronic) with the Department of Revenue for
any taxable year after 1997 and before 2013.
Any person, including minor dependents, whose personally identifiable information was
contained on such a return.

The deduction is equal to the actual costs for the contract or subscription incurred for the taxable
year, up to $300 for an individual taxpayer or $1,000 for taxpayers filing joint returns or returns
claiming dependents. Individuals cannot claim the deduction if (a) they deducted the same costs
as a business expense or (b) they are enrolled in the identity theft protection and resolution
services offered free of charge by the State.
Taxpayers May Be Able to Seek Reimbursement for Identity Theft Losses
Disclaimer: The following summary is offered for informational purposes only. For further
details as to funding or administration of this reimbursement program, please contact the State
Treasurer’s Office (www.treasurer.sc.gov).
The “Department of Revenue Identity Theft Reimbursement Fund” has been established for the
current fiscal year, to be administered by the State Treasurer. It is designed to reimburse persons
(whether an individual or a business) who suffer actual financial losses directly related to misuse
of personally identifiable information obtained from a compromised computer maintained by a
state agency, board, committee or commission.

2

The statute contains a list of expenses that are reimbursable and also provides information about
expenses that are not reimbursable. Reimbursement is subject to availability of monies in the
fund. A claim for reimbursement must be submitted to the State Treasurer on a form provided
by the Treasurer. Each claim must be considered within 90 days after filing, and the Treasurer
must give written notice to the claimant if the claim is denied in whole or in part.
The Treasurer’s decision may be appealed to the Administrative Law Court. To appeal, the
claimant must bring an action naming the Treasurer as the defendant within 90 days after the
decision or, if the Treasurer fails to act on the claim, within 180 days of the filing of the claim.
The Laws Governing Identity Theft and Related Crimes Have Been Updated to Make It Easier
to Initiate Investigations and Prosecute Offenders
The Consumer Protection Code has been updated to require a local law enforcement agency with
jurisdiction over the actual legal residence of an identity theft victim to begin an investigation
when the victim files a report. The agency no longer has the option to refer the matter to another
law enforcement agency where the alleged crime was committed.
Further, under changes to the law made this year, the crimes of identity fraud (using another’s
personal identifying information to obtain employment or evade law enforcement) and financial
identity fraud (obtaining or using personal identifying information to unlawfully target another’s
financial resources), may now be prosecuted either in the county in which the information is
obtained and used or in the county in which the victim resided at the time the information was
obtained or used. The definition of “Personal identifying information” for the purposes of these
crimes has been expanded.
Changes Made to Procedures for Notification of South Carolina Residents in the Event of a
State Agency Security Breach
If a state agency discovers any breach of data security, the agency must notify each South
Carolina resident whose personal identifying information (as that term is defined in the data
breach law) was, or is reasonably believed to have been, acquired by an unauthorized person.
Notification must be made as expeditiously as possible and without unreasonable delay.
However, notification may be delayed if a law enforcement agency determines that it hinders a
criminal investigation. A delay in notification shall not exceed 72 hours after discovery, unless
the agency requests and the Attorney General grants, in writing, additional delays of up to 72
hours each upon a determination that notification hinders a criminal investigation.
The notification requirement is not triggered if:
• The data is encrypted or redacted (unless an encryption key is also acquired).
• The information is lawfully obtained from publicly available information, or from federal,
state or local government records lawfully made available to the general public.
3

The notice to the resident must include the agency’s contact information and a description of the
information compromised, including specifics about the elements of personal information and
private information believed to have been improperly acquired. If an agency does not provide
the notice as required by the law, and the resident is harmed by the agency’s failure to do so, the
resident may institute a civil action to recover damages, seek an injunction to force compliance
with the law, and recover attorney’s fees and court costs if the resident is successful with these
actions.
How to Find the Full Text of New Legislation
Below is a list of New Security and Identity Theft Legislation enacted during the 2013 legislative
session.
These bills are listed in numeric order. The list of bills with a link to the full text of each act is on
the Department’s website at:
http://www.sctax.org/Tax+Policy/New+Security+and+Identity+Theft+Legislation.htm

BILL #
ACT #
3248 – Section 1 and 2
15
3710 – Proviso 97.12
101
3710 – Proviso 117.136
101
3710 – Proviso 118.18
101
3711 – Section 2
104

SUBJECT
Changes to Identity Theft Criminal Provisions
Identity Theft Reimbursement Fund
Notice of Data Security Breach
Income Tax Deduction for Consumer Protection Services
Identity Theft Services – Free Coverage Period Extended

4